A free hardware scanner from NullMoth Systems. A Windows app turns a USB stick into a small offline scanner. You start your PC from the stick, it reads what hardware the machine has, and it saves one report to the stick. You read the report, then upload it yourself if you want to.
Download and how-to: nullmothsystems.com/probe
- The Windows app erases the USB stick you pick, after asking twice. It only lists USB drives.
- The scanner has no network, Wi-Fi or Bluetooth drivers. It cannot connect to anything.
- Before it scans, it marks every drive except its own stick read-only. It never mounts your internal drives.
- It never changes BIOS/UEFI settings. The report has serial numbers, UUIDs, MAC addresses and the Windows product key removed before it is saved.
The installer is not code-signed yet, so Windows SmartScreen will warn you. Check its fingerprint instead. The expected SHA-256 is published in DNS, signed with DNSSEC, separately from the download server:
dig +short TXT _probe-sha256.nullmothsystems.com
On Windows, compare it against the file you downloaded:
Get-FileHash .\1401-Probe-Setup.exe -Algorithm SHA256
If they differ, do not run it.
Everything builds in Docker containers pinned by digest. Nothing is installed on the host.
NM_ALLOW_NO_PRIVATE=1 ./build.sh all
out/usb/andout/1401-probe.img: the scanner stick (Alpine Linux, offline)out/windows/1401-Probe-Setup.exe: the Windows app and installer
NM_ALLOW_NO_PRIVATE=1 skips one release check that only the maintainer's machine can run.
The first build makes a seal key at ~/.config/nullmoth/seal/<version>.key (your own; reports from your build are
sealed with it). NM_ALLOW_NO_SEAL=1 builds without one, and its reports say "sealed": false.
What changed in each version: CHANGELOG.md.
./test/qemu-test.sh boots the real stick image on an emulated PC and fails if a planted serial number survives
into the report, if any network interface appears, or if the emulated SSD changes by one byte (it needs QEMU with
UEFI firmware).
| Path | What |
|---|---|
probe/ |
the scanner: image build, boot config, probe.py (scan, redact, report) |
windows/ |
the Windows app (.NET Framework 4.8), the NSIS installer, their build |
docs/ |
the licence shown in the app, instructions, third-party and firmware notices |
test/ |
the QEMU end-to-end test |
1401 Probe is free software under the GNU General Public License v3.0 or later (LICENSE). The
parts it is built from (Linux, GRUB, BusyBox, Python, Alpine packages, firmware files) keep their own licenses,
listed in THIRD-PARTY-NOTICES.txt on every stick.
The names NullMoth and NullMoth Systems and the moth logo are © 2026 NullMoth Systems and are not licensed (GPL-3.0 section 7(e)). Unmodified copies may carry them as shipped; a modified version must drop them.